CVE-2017-8815
HighSummary
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.
Risk Assessment
Such attacks may lead to unauthorized access to data or content manipulation, posing a serious threat to the integrity of the system.
Recommendation
It is recommended to update MediaWiki to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in MediaWiki
See all- CVE-2026-34092High
A vulnerability in MediaWiki related to the exposure of sensitive information to unauthorized actors. It affects program files includes/Skin/Skin.Php.
- CVE-2026-34091High
CVE-2026-34091 describes an exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.
- CVE-2026-34088High
CVE-2026-34088 involves the exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.
- CVE-2017-8814High
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by 'a lot of junk.'
- CVE-2017-8810High
MediaWiki versions before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provide different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.
- CVE-2012-4380High
MediaWiki versions before 1.18.5 and 1.19.x before 1.19.2 allow remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
- CVE-2016-6337High
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.
- CVE-2016-6335High
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, allowing remote attackers to obtain sensitive information via a parse action to api.php.
- CVE-2016-6332High
MediaWiki versions before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, may allow remote attackers to obtain sensitive information by failing to terminate sessions when a user account is blocked.
- CVE-2016-6331High
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.
Original NVD description (English source)
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.